diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
index d1ecf8ce94d0..c6307665da69 100644
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -3975,7 +3975,14 @@ nsDocument::AddEventListener(const nsAString& aType,
                              nsIDOMEventListener* aListener,
                              PRBool aUseCapture)
 {
-  return AddGroupedEventListener(aType, aListener, aUseCapture, nsnull);
+  PRBool permitUntrustedEvents = PR_FALSE;
+  if (mDocumentURI) {
+    PRBool isChrome = PR_TRUE;
+    nsresult rv = mDocumentURI->SchemeIs("chrome", &isChrome);
+    NS_ENSURE_SUCCESS(rv, rv);
+    permitUntrustedEvents = !isChrome;
+  }
+  return AddEventListener(aType, aListener, aUseCapture, permitUntrustedEvents);
 }
 
 nsresult
diff --git a/content/base/src/nsGenericElement.cpp b/content/base/src/nsGenericElement.cpp
index 9e542097abc2..9e0e1a073357 100644
--- a/content/base/src/nsGenericElement.cpp
+++ b/content/base/src/nsGenericElement.cpp
@@ -627,15 +627,21 @@ nsDOMEventRTTearoff::GetSystemEventGroup(nsIDOMEventGroup **aGroup)
 
 // nsIDOMEventTarget
 NS_IMETHODIMP
-nsDOMEventRTTearoff::AddEventListener(const nsAString& type,
-                                      nsIDOMEventListener *listener,
+nsDOMEventRTTearoff::AddEventListener(const nsAString& aType,
+                                      nsIDOMEventListener *aListener,
                                       PRBool useCapture)
 {
-  nsCOMPtr<nsIDOMEventReceiver> event_receiver;
-  nsresult rv = GetEventReceiver(getter_AddRefs(event_receiver));
-  NS_ENSURE_SUCCESS(rv, rv);
+  PRBool permitUntrustedEvents = PR_FALSE;
+  nsIDocument *ownerDoc = mContent->GetOwnerDoc();
+  nsIURI *docUri;
+  if (ownerDoc && (docUri = ownerDoc->GetDocumentURI())) {
+    PRBool isChrome = PR_TRUE;
+    nsresult rv = docUri->SchemeIs("chrome", &isChrome);
+    NS_ENSURE_SUCCESS(rv, rv);
+    permitUntrustedEvents = !isChrome;
+  }
 
-  return event_receiver->AddEventListener(type, listener, useCapture);
+  return AddEventListener(aType, aListener, useCapture, permitUntrustedEvents);
 }
 
 NS_IMETHODIMP
diff --git a/content/events/src/nsEventListenerManager.cpp b/content/events/src/nsEventListenerManager.cpp
index 2d185ceea387..5e13dcb39643 100644
--- a/content/events/src/nsEventListenerManager.cpp
+++ b/content/events/src/nsEventListenerManager.cpp
@@ -758,7 +758,8 @@ nsEventListenerManager::RemoveEventListener(nsIDOMEventListener *aListener,
 
   for (PRInt32 i=0; i<listeners->Count(); i++) {
     ls = (nsListenerStruct*)listeners->ElementAt(i);
-    if (ls->mListener == aListener && ls->mFlags == aFlags) {
+    if (ls->mListener == aListener &&
+        (ls->mFlags & ~NS_PRIV_EVENT_UNTRUSTED_PERMITTED) == aFlags) {
       ls->mSubType &= ~aSubType;
       if (ls->mSubType == NS_EVENT_BITS_NONE) {
         NS_RELEASE(ls->mListener);
diff --git a/content/events/src/nsEventListenerManager.h b/content/events/src/nsEventListenerManager.h
index 92ac572f505e..d94cd5ec2961 100644
--- a/content/events/src/nsEventListenerManager.h
+++ b/content/events/src/nsEventListenerManager.h
@@ -51,11 +51,11 @@ class nsIAtom;
 
 typedef struct {
   nsIDOMEventListener* mListener;
-  PRUint8 mFlags;
-  PRUint8 mSubType;
-  PRUint8 mHandlerIsString;
-  PRUint8 mSubTypeCapture;
+  PRUint16 mFlags;
   PRUint16 mGroupFlags;
+  PRUint8  mSubType;
+  PRUint8  mHandlerIsString;
+  PRUint8  mSubTypeCapture;
 } nsListenerStruct;
 
 //These define the internal type of the EventListenerManager
diff --git a/dom/src/base/nsGlobalWindow.cpp b/dom/src/base/nsGlobalWindow.cpp
index 54a932a59944..6fde9bee1143 100644
--- a/dom/src/base/nsGlobalWindow.cpp
+++ b/dom/src/base/nsGlobalWindow.cpp
@@ -4074,7 +4074,16 @@ nsGlobalWindow::AddEventListener(const nsAString& aType,
                                  nsIDOMEventListener* aListener,
                                  PRBool aUseCapture)
 {
-  return AddGroupedEventListener(aType, aListener, aUseCapture, nsnull);
+  PRBool permitUntrustedEvents = PR_FALSE;
+  nsCOMPtr<nsIDocument> doc(do_QueryInterface(mDocument));
+  nsIURI *docUri;
+  if (doc && (docUri = doc->GetDocumentURI())) {
+    PRBool isChrome = PR_TRUE;
+    nsresult rv = docUri->SchemeIs("chrome", &isChrome);
+    NS_ENSURE_SUCCESS(rv, rv);
+    permitUntrustedEvents = !isChrome;
+  }
+  return AddEventListener(aType, aListener, aUseCapture, permitUntrustedEvents);
 }
 
 NS_IMETHODIMP